---
id: 8671
title: "Implant Teardown"
source_domain: projectzero.google
source_url: "https://projectzero.google/2019/08/implant-teardown.html"
published_at: "2019-08-29T00:00:00Z"
tags: ["ios", "forensics", "project-zero", "implant", "in-the-wild"]
phying_url: "https://phying.com/item/8671"
lang: en
---

# Implant Teardown

## Summary

Here's a conversation in Google Hangouts for iOS and the corresponding database file uploaded by the implant. With some basic SQL we can easily see the plain text of the messages, and even the URL of the images shared. The implant can upload private files used by all apps on the device; here's an example of the plaintext contents of emails sent via Gmail, which are uploaded to the attacker's server:

## Intelligence Metadata

- **Sources:** projectzero.google
- **Published:** 2019-08-29T00:00:00Z
- **Original:** https://projectzero.google/2019/08/implant-teardown.html
- **Phying News:** https://phying.com/item/8671